About that DOJ Request

Some random bits scribbled by Jeremy Zawodny

I've waited several days and thought quite a bit before saying anything about the Department of Justice asking search engines for search data. I waited partly because I didn't want to say something I'd regret, and that was pretty likely to happen early on. And partly because I wanted to see how the companies involved were going to handle the situation. Most did a very poor job.

I was initially tempted to post instructions and screen shots for each major search engine. They'd illustrate, step-by-step, how to sign out and search anonymously--you know, just in case. But that's a lot of work and all I really wanted to say was this: I'm disappointed.

I'm disappointed in the government for wanting to use the online behavior of millions of people in an attempt to justify a law that many of those million are likely against. I'm disappointed in them for making people even more fearful of "being tracked online" and the Bush Administration's attempts to keep an eye on the public.

I'm disappointed in those companies that appeared not to put up a fight, notify their users, or explain what happened in a timely fashion. I'm disappointed in them for not providing an opt-out mechanism. I guess that's everyone but Google so far.

I'm disappointed in the general public for jumping to conclusions about what happened before the story had really been worked out.

I'm disappointed in the media for helping to scare the public. They, like the government, appear to be doing what they're best at and that's pretty troublesome.

I hope that people will stop IMing, emailing, and otherwise asking me what I think of all this and what Yahoo's position is. In case it's not clear, I'm not speaking on behalf of anyone other than myself. And the Powers That Be have decided not to say much on the matter. So there you have it.

Don't you think that Google's move (i.e resistance) is also a tactical move to improve its "love ranking" by end users?

I really think that it could be after E. Felten's conclusion on Google Video "Privacy is for Google what security is for Microsoft. At some point Microsoft realized that a chain of security disasters was one of the few things that could knock the company off its perch. And so Bill Gates famously declared security to be job one, thousands of developers were retrained, and Microsoft tried to change its culture to take security more seriously.
Itís high time for Google to figure out that it is one or two privacy disasters away from becoming just another Internet company. The time is now for Google to become a privacy leader"

re: disappointment in the governement and the media. I'm not sure why you would expect anything else but fear mongering and ridiculous demands of private data from private companies.

I think the search companies' responses is the worst part of this whole thing. The scariest part is that if Google hadn't refused the DOJ then all this would've happened without any sort of public discourse or knowledge (just like the administration likes it, I suppose).

I'm disappointed with all the companies that capitulate too, although as what one of the previous posters have said, I'm not sure what is Google's reason/intent in defying the government. Morality or just smart branding?

To be fair, DOJ DOES have subpoena power and, short of challenging a subpoena in court and getting a judge to issue a stay, every company involved behaved appropriately. Yahoo, MSN and AOL complied as they were compelled to and Google did what it felt was right to avoid it. No one did anyting wrong on this.

I think the real complaint is not with the search companies or DOJ... it's with the culture of the Executive branch of government. Do I think Bush was responsible for this? Only so much as he his head of the Executive branch. My feeling is is that he slapped his head in disbelief when this story surfaced.

I think that the DOJ request was probably on the up and up. It probably is not about getting any other information but data regarding the probability of children encountering porn on the web. That said, it is such a dangerous precedent to set and to allow.

Good topic, Jeremy, and I certainly don't want to drag this into political mudslinging. It just so happens that you dabbled in an area I enjoy! :)

I'm still confused on how this is a privacy issue. There was no personal identifying information tagged to the results that were collected by the DOJ and supplied by the search engines.

Can someone explain how this is a privacy issue? To me it would be the same thing as the DOJ going to every radio station and asking what were the most requested songs from it's users over a 1-year period.

Or the fact that 4 out of 5 dentists recommend Trident. Is that a privacy issue? Who am I to need to know what kind of chewing gum dentists prefer?

Yahoo, MSN and AOL simply demonstrated that they were less worthy of consumer trust than Google. I assume that those companies are also more likely than Google to be supplying complete search histories or targetted search histories without due process first in other situations.

Yes, _with cause_ it's possible to get a court to order disclosure. But it's worth having the government pass that hurdle of showing cause before providing data.

In the airline industry, this disclosure on request without proper checks is part of the repeat scandals of airlines disclosing passenger data which helped to doom the CAPPS II system.

Of course, this particular request will simply show that adult content is extremely popular and there will be a tremendous restriction of adult access to that content if the government achieves its objective and thereby blocks search engine access to much of what people are searching for.

Blaming the media is not appropriate in this particular case. It's not their job to make people feel good about the status quo. (That's the government's job.) If their reporting on the issue is accurate, and it appears to be, then they're in the clear as far as I'm concerned.

This episode does not prove that Yahoo is evil or Google is good (or more worthy of our trust). It's wrong for people to blame businesses when this kind of thing comes up because we all live in a society of laws -- the people who are driving this are in the government, and if we don't like it, then we need to work harder to make sure that the people who find themselves in positions of authority in government are worthy of our trust.

Narayandude: Similiar subpoenas have certainly been done in the past, but typically they were along the lines of "show us all searches done by this person (at this IP) because we have this cause". It was not so broad and far-reaching, and so typically would just happen silently.

but this is a new, broad context for the application of these powers which should be challenged in court.

the DOJ is part of the executive branch. the executive branch is not the government. there are grounds for a challenge.

if google is succesful, users will have greater assurances of privacy.

if google is not succesful, at the very least the government may be forced to divulge how exactly it intends to use this data, resulting in greater transparency.

either way, regular people who have almost no recourse on unchecked power win in some way by having this action challenged.

we are crossing fundamental lines that will be very difficult to pass back over later, if not impossible. this isn't about being loyal to your employer, it is about the kind of society you want to live and work in.

Jeremy, does Yahoo have publicly available data retention policies for IP addresses or cookie or otherwise stored ids which could be used to determine an IP the next time a specific computer connected with a specific search visited Yahoo Search again? That is, IP leads to connection which leads to person, so what are the basic things like retention periods for such personally identifying information?

Personally identifying information in this context means anything an investigation of any form could use to get to the identity or likely identity of a person.

About 10 years ago, I think it was in Indiana, there was an attack on a Jewish home displaying a Menorah. I remember that the local paper responded by publishing a double-page spread graphic of a Menorah, and hundreds of homes throughout this small community cut out the image and displayed it in their windows.

Can the SEM community launch a campaign to make the Govt's snooping pointless by running searches on hot button topics ("Osama bin Laden is a hottie", anyone?) that will work the Echelon-borgs up into a self-destroying frenzy of surveillance? Just wondering....

I completely agree with Jeremy except for one thing. I am a little disappointed in the responses from the executives of the companies who have responded.

And I can't be disappointed in this adminstration's handling of this incident.

This is a government formed by liars, cheats, and thiefs.

The worst part is that so many people out there are so mentally bankrupt, that they actually think that this kind of thing is okay.

I'll say this...if your kid has a pc in their room and they go in and close the door, then there is no one to blame for what they are viewing but the parent.

Kids are kids. They don't have a right to privacy or to conduct themselves behind closed doors.

As their parent, you have the obligation to insure that you keep them away from these materials but the rest of us do not have to suffer because you don't want your kid seeing something they are going to see and probably do, in a few short years anyway.

>> GrumpY!, you really believe the executive branch is "not the government?" What country do you live in?

the same one as many members of Congress and the Senate who have challenged executive power claim to live in - one ruled by the balance of power described in the Constitution, not by any single branch of government.

we have choices. the Constitution does not compel us to yield to power, in fact it specifially addresses our defenses against unchecked power.

but if you prefer kings, there are still a few holdouts out there in the world that would welcome you.

"the subject who is truly loyal to the Chief Magistrate will neither advise nor submit to arbitrary measures" - Junius

I'm disappointed that MOST search engine companies rolled over silently and did not publicly protest giving their data away based on a government request that is specious at best and that has no bearing on an active criminal or security investigation. It makes me wonder how they will handle similar requests in the future that *do* include identity information.

I'm disappointed that ALL search engine companies value my privacy so little that they *retain* my IP address and/or user cookie *attached* to specific queries, rather than "anonymizing" this data after the short period needed for advertising logic and intrusion detection. More:

All good reasons to be disappointed. I'm also disappointed that the debate about this usually suggests Google is "protecting" me while they carefully monitor and save my data.

My concern is more with the fact that Yahoo & Google & MSN appear to be watching everybody so carefully than with the very small possibility the Government will *ALSO* get access to that info AND use it to abuse my privacy.

Most onliners are happily (naively?) sacrificing privacy to Google and Yahoo every day.

Jeremy, you said, "I'm disappointed in those companies that appeared not to put up a fight, notify their users, or explain what happened in a timely fashion. I'm disappointed in them for not providing an opt-out mechanism. I guess that's everyone but Google so far."

Let's be clear about exactly what happened:

1. All four search engines got (probably) exactly the same subpoenas back in August -- Google included. None of them, Google included, notified their users or explained.

2. None of the search engines "complied" with the original terms of the subpoena.

3. Yahoo, MSN and AOL ultimately gave the Feds info quite different than what was asked for.

4. The Motion to Compel Google to cough up says the Feds' final offer came after "lengthy negotiation." It's not clear whether Google's side of that negotiation was simply, "No. No. No." or whether there was something they were willing to do but it wasn't enough for the Feds.

That's not to say I'm not disappointed, outraged and scared by the whole mess. I just don't think Google is so saintly.

I've been watching this as well and find the concerns by the citizens lost in smut. These are my opinions and not up for debate.

First, the only time a search engine knows how the heck you are is when you log in and then do a search. That then tags personnally identifiable information to the search. So, if people are really concerned with others learning their nasty and illicit behaviors then they should do it annonymously. Otherwise you have no privacy rights to protect because States have the right to request information about who from their State is looking at child smut or any other smut. Oklahoma for example has a law that makes it illegal to have any movies or materials showing penetration and child smut. You'll do serious time.

Second, there's nothing wrong with providing aggregated information under for any legal reason. Assuming so is a clear indication that you have a guilty conscious and should stop looking at child smut. LOL

Third, Google was not protecting their users. They were attempting to protect their own personal/corporate privacy with the assumption that with all the requested information someone could do enough research and determine their algorithm. The US government has no desire to do that. They are simply attempting to perform a much needed service by protecting our children from illicit behaviors.

Fourth, I commend the other search engines in complying with the request of the US Judicial System. Assuming Bush was responsible is a flagrant miscarriage of justice. Congress which is the legislative body is promoting the issue in an attempt to clean up our country of the massive moral decay we face.

Fifth, just to throw religion in here, this country was founded on Christian values with an attempt to not demand people practice a particular sect. It was not founded by a bunch of atheists going around committing henious acts with children.

I hope Google loses a lot on this as people begin to realize that it's not their privacy but Google's privacy Google attempts to protect.

I'm not really worried about this request as an immediate privacy threat although the slippery slope is disconcerting.

What I do not understand is how the government can make such a request to entities that have nothing to do with the matter. Could not the goverment obtain this material on the open market from a provider such as compete.com?

Disclaimer: The opinions expressed here are mine and
mine alone. My current, past, or previous employers are not responsible for what I
write here, the comments left by others, or the photos I may share. If
you have questions, please contact
me. Also, I am not a journalist or reporter. Don't "pitch" me.

Privacy: I do not share or publish the email addresses
or IP addresses of anyone posting a comment here without consent.
However, I do reserve the right to remove comments that are spammy,
off-topic, or otherwise unsuitable based on my comment
policy. In a few cases, I may leave spammy comments but remove any
URLs they contain.